code wiki / (root) / nx_charjudge_census.nx
`nx_charjudge_census.nx` source

↩ module page · 1576 lines · 79158 B
1// nx_charjudge_census.nx -- THE CHARACTER REFEREE AS A STANDING INSTRUMENT: judge an ENTIRE named corpus in
2// one call, one line per image, with the partition reconciled -- AND (2026-08-19, GR1 of /compare/graphics,
3// Phase 0 of the past-MetaHuman roadmap) THE JUDGE PANEL `cjc_panel`: a multi-lens referee that can see
4// what the single statistics judge is proven blind to.
5//
6// WHY IT EXISTS: the judge was a single-image CLI, so grading a corpus meant one invocation per file. That
7// cost is exactly what turns "measure the population" into "measure a sample", and a tooling gap is never a
8// licence to sample. The whole render corpus is now one call.
9//
10// WHY THE PANEL EXISTS (measured 2026-08-16, both directions): nx_charjudge scored a GREEN CLAY figure crop
11// 257 (the operator saw gumby) and a smooth photoreal-class splat render 0 ("smooth = no detail"). Its axes
12// (composition, palette, contour, face) are hue- and semantics-agnostic BY CONSTRUCTION, so every fidelity
13// claim graded through it alone is ungradeable. The panel COMPOSES incumbents, never re-implements:
14//   stats    = ./nx_charjudge.elf            (the statistics judge, forked -- the artifact that ships)
15//   skin     = nx_color_kovac_skin_pixel     (Kovac 2003 published skin gamut, over the figure / centre)
16//   sym      = ./nx_image_beauty.elf path    (bilateral symmetry Q1000, forked)
17//   percept  = ./nx_percept.elf judge        (RELATIVE perceptual position vs the 10 human-confirmed
18//                                             commercial frames minus the junk controls; admitted only
19//                                             while its own ladder reproduces the human ordering)
20//   vlm      = UNOBSERVABLE                  (no sovereign VLM oracle exists on the estate -- measured
21//                                             2026-08-19 by tree grep + local probe; the slot abstains,
22//                                             it never acquits)
23// THE LAW THE PANEL IS BUILT UNDER: AN UNCALIBRATED CLASSIFIER REPORTS NUMBERS, NEVER VERDICTS. `panel`
24// prints every lens value for every image always; it prints a GOOD/BAD verdict ONLY while an admission
25// receipt written by `calibrate` says FP=0 and FN=0 on a LABELLED corpus with both classes present -- and
26// the receipt is bound to the exact floors it was measured at, so editing the conf silently un-admits.
27// Floors are DATA (knowledge/cjc_panel.conf), never literals here. A lens with no floor in the conf is
28// REPORT-ONLY (printed, not voting): that is how a lens proven blind is retired from the vote by evidence.
29// Composite = AND over voting lenses (the MIN-headline doctrine: no lens may be compensated by another).
30//
31// WHY IT FORKS rather than looping in-process: chj_judge allocates several w*h*8 working buffers per frame,
32// so an in-process sweep multiplies every one of them by the corpus size -- measured, that is gigabytes of
33// address space on a box already sitting at 727 permil swap. A child returns its entire working set to the
34// OS on exit, so peak RSS is ONE frame regardless of corpus size. Forking also means this census measures
35// the artifact that ACTUALLY SHIPS rather than a second compiled copy of the same lib: if the promoted
36// binary is stale or missing, that surfaces here instead of being hidden by an identical rebuild.
37// The panel keeps that design: the parent forks ITSELF (`lens <path> <conf>`) per image; the child decodes
38// once (nx_img_to_rgb: PNG/JPEG/GIF/WebP-lossless/BMP/...), computes the in-process lenses on a bounded
39// fit-resampled frame, forks the three sibling judges, and prints ONE anchored line.
40//
41// NO SAMPLING, NO SILENT CAP: every row is attempted; failures are counted AND NAMED; a truncated child
42// capture is counted and forces a non-zero exit; the partition is printed and must reconcile or the census
43// refuses its own numbers.
44// argv:
45//   <list-file> [judge-elf]                 legacy census (unchanged): one path per line, '#' comments skipped
46//   panel <list-file> [conf]                the panel: rows `path[<TAB>GOOD|BAD]`; verdicts only if admitted
47//   calibrate <labelled-list> [conf]        panel + confusion per lens + receipt; exit 0 admitted, 1 refused
48//   lens <image> [conf]                     one image, one anchored line (the per-image child)
49//   topng <in-image> <out.png>              bank any decodable reference as PNG (sibling judges are PNG-only)
50//   figcrop <in-image> <out.png> [conf]     SAME-FRAMING instrument: crop to the figure bbox (pixels that differ
51//                                           from the corner-mean background by > bg_tol) + a margin derived from
52//                                           the bbox itself; the GR2 done-rule compares "on the same framing"
53// license_tier: ORIGINAL   No hw writes (Rule 26).
54import "nx_syscalls.nx"
55import "nx_itoa_lib.nx"
56import "nx_tool_run.nx"
57import "nx_img_to_rgb.nx"
58import "nx_png_write.nx"
59import "nx_nxfh_lib.nx"
60import "nx_color_v2.nx"
61
62const CJX_PATHCAP: i64 = 1024
63const CJX_OUTCAP: i64 = 8192
64const CJX_TIMEOUT_MS: i64 = 60000
65const CJX_ARGV_SLOTS: i64 = 4
66const CJX_HASH: i64 = 35
67const CJX_NL: i64 = 10
68const CJX_CR: i64 = 13
69const CJX_TAB: i64 = 9
70const CJX_D0: i64 = 48
71const CJX_D9: i64 = 57
72const CJX_MINUS: i64 = 45
73const CJX_PERMIL_MAX: i64 = 1000
74
75// ---- panel constants: sentinels and formats, never thresholds (thresholds ride the conf) ----
76const CJP_UNOBS: i64 = 0 - 9999          // a lens that could not see: abstain, never acquit
77const CJP_CONFCAP: i64 = 65536
78const CJP_RECEIPTCAP: i64 = 4096
79const CJP_CHILD_ARGV: i64 = 5
80const CJP_CHILD_OUTCAP: i64 = 16384
81const CJP_LABEL_GOOD: i64 = 1
82const CJP_LABEL_BAD: i64 = 0
83const CJP_LABEL_NONE: i64 = 0 - 1
84const CJP_FNV_BASIS: i64 = 2166136261
85const CJP_FNV_PRIME: i64 = 16777619
86const CJP_FNV_MASK: i64 = 4294967295
87const CJP_MODE_644: i64 = 420
88const CJP_BYTE: i64 = 256
89const CJP_LENSES: i64 = 5              // stats skin sym percept vlm
90const CJP_SKRULES: i64 = 3             // kovac | chroma | locus -- every run reports all three
91const CJP_SK_KOVAC: i64 = 0
92const CJP_SK_CHROMA: i64 = 1
93const CJP_SK_LOCUS: i64 = 2
94const CJP_L_STATS: i64 = 0
95const CJP_L_SKIN: i64 = 1
96const CJP_L_SYM: i64 = 2
97const CJP_L_PERCEPT: i64 = 3
98const CJP_L_VLM: i64 = 4
99// conf defaults that are CONTRACTS of the organs composed, not tuning: nx_percept's frame is 400x240 NXFH1
100// (its own PJ_W/PJ_H); override in the conf if nx_percept ever changes its contract.
101const CJP_DEF_PERCEPT_W: i64 = 400
102const CJP_DEF_PERCEPT_H: i64 = 240
103const CJP_DEF_CENTER_PERMIL: i64 = 500
104const CJP_DEF_BG_TOL: i64 = 24
105const CJP_DEF_CROP_MARGIN_PERMIL: i64 = 50      // figcrop margin = 5 percent of the larger bbox side (conf: crop_margin_permil)
106const CJP_DEF_BG_INSET_PX: i64 = 4              // background sampled this far inside each corner (conf: bg_inset_px) --
                                              // a clipped canvas capture carries its 1-px CSS border at the very corner
108const CJP_DEF_EDGE_IGNORE_PX: i64 = 2           // figcrop ignores this edge ring when scanning for figure pixels (conf)
109
110func cjx_p(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
111func cjx_n(v: i64) -> i64 { nxi_out(v); return 0 }
112func cjx_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
113func cjx_cat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64=0; var p: i64=o; while s[i]!=(0 as u8){ d[p]=s[i]; p=p+1; i=i+1 } d[p]=0 as u8; return p }
114func cjx_catn(d: *u8, o: i64, v: i64) -> i64 {
  var m: i64 = v
  var p: i64 = o
  if m < 0 { d[p] = CJX_MINUS as u8; p = p + 1; m = 0 - m }
  let t: *u8 = sys_mmap(32)
  var k: i64 = 0
  if m == 0 { t[0] = CJX_D0 as u8; k = 1 }
  while m > 0 { t[k] = (CJX_D0 + (m % 10)) as u8; m = m / 10; k = k + 1 }
  while k > 0 { d[p] = t[k-1]; p = p + 1; k = k - 1 }
  d[p] = 0 as u8
  return p
125}
126func cjx_streq(a: *u8, b: *u8) -> i64 {
  var i: i64 = 0
  while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 }
  if b[i] != (0 as u8) { return 0 }
  return 1
131}
132
133// Read the integer that follows an ANCHORED field name. The child emits this token exactly once per line,
134// so the parse cannot drift onto a value that merely looks like the answer -- the failure mode that has bit
135// this estate three times when an unanchored or greedy pattern matched a report's own prose instead of its
136// data. Returns -1 when the field is absent, which is a DISTINCT outcome from a value of 0.
137func cjx_field(buf: *u8, n: i64, key: *u8) -> i64 {
  var kn: i64 = 0
  while key[kn] != (0 as u8) { kn = kn + 1 }
  var i: i64 = 0
  while i + kn <= n {
      var k: i64 = 0
      var hit: i64 = 1
      while k < kn {
          if buf[i+k] != key[k] { hit = 0; k = kn }
          if hit == 1 { k = k + 1 }
      }
      if hit == 1 {
          var q: i64 = i + kn
          var v: i64 = 0
          var got: i64 = 0
          var go: i64 = 1
          while go == 1 {
              if q >= n { go = 0 }
              if go == 1 {
                  let c: i64 = buf[q] as i64
                  if c >= CJX_D0 { if c <= CJX_D9 { v = v*10 + (c-CJX_D0); got = 1; q = q + 1 } }
                  if c < CJX_D0 { go = 0 }
                  if c > CJX_D9 { go = 0 }
              }
          }
          if got == 1 { return v }
          return 0-1
      }
      i = i + 1
  }
  return 0-1
168}
169
170// SIGNED anchored field: nx_percept's score is legitimately negative (similar to junk), and an unsigned
171// parse would read "score":-57 as ABSENT and the lens would silently become unobservable. Returns
172// `absent` (caller-chosen sentinel) when the field is missing.
173func cjx_sfield(buf: *u8, n: i64, key: *u8, absent: i64) -> i64 {
  var kn: i64 = 0
  while key[kn] != (0 as u8) { kn = kn + 1 }
  var i: i64 = 0
  while i + kn <= n {
      var k: i64 = 0
      var hit: i64 = 1
      while k < kn {
          if buf[i+k] != key[k] { hit = 0; k = kn }
          if hit == 1 { k = k + 1 }
      }
      if hit == 1 {
          var q: i64 = i + kn
          var neg: i64 = 0
          if q < n { if (buf[q] as i64) == CJX_MINUS { neg = 1; q = q + 1 } }
          var v: i64 = 0
          var got: i64 = 0
          var go: i64 = 1
          while go == 1 {
              if q >= n { go = 0 }
              if go == 1 {
                  let c: i64 = buf[q] as i64
                  if c >= CJX_D0 { if c <= CJX_D9 { v = v*10 + (c-CJX_D0); got = 1; q = q + 1 } }
                  if c < CJX_D0 { go = 0 }
                  if c > CJX_D9 { go = 0 }
              }
          }
          if got == 1 { if neg == 1 { return 0 - v } return v }
          return absent
      }
      i = i + 1
  }
  return absent
206}
207
208func cjp_nl(b: *u8, at: i64) -> i64 { if (b[at] as i64) == CJX_NL { return 1 } return 0 }
209
210// ---- conf: `key=value` lines, '#' comments. An ABSENT key is a distinct answer from a value of 0 (a
211// lens whose floor is absent is report-only; a floor of 0 is a floor). found[0] says which.
212func cjp_conf_int(cf: *u8, n: i64, key: *u8, def: i64, found: *i64) -> i64 {
  found[0] = 0
  let kn: i64 = cjx_slen(key)
  var i: i64 = 0
  while i < n {
      // line start
      var e: i64 = i
      var go: i64 = 1
      while go == 1 { if e >= n { go = 0 } else { if cjp_nl(cf, e) == 1 { go = 0 } else { e = e + 1 } } }
      if (cf[i] as i64) != CJX_HASH {
          if e - i > kn {
              var k: i64 = 0
              var hit: i64 = 1
              while k < kn { if cf[i+k] != key[k] { hit = 0; k = kn } if hit == 1 { k = k + 1 } }
              if hit == 1 { if (cf[i+kn] as i64) == 61 {
                  var q: i64 = i + kn + 1
                  var neg: i64 = 0
                  if q < e { if (cf[q] as i64) == CJX_MINUS { neg = 1; q = q + 1 } }
                  var v: i64 = 0
                  var got: i64 = 0
                  var go2: i64 = 1
                  while go2 == 1 {
                      if q >= e { go2 = 0 } else {
                          let c: i64 = cf[q] as i64
                          if c >= CJX_D0 { if c <= CJX_D9 { v = v*10 + (c-CJX_D0); got = 1; q = q + 1 } else { go2 = 0 } } else { go2 = 0 }
                      }
                  }
                  if got == 1 { found[0] = 1; if neg == 1 { return 0 - v } return v }
              } }
          }
      }
      i = e + 1
  }
  return def
246}
247
248// string-valued conf key (elf paths, receipt path); returns def when absent. Value is copied to a fresh buf.
249func cjp_conf_str(cf: *u8, n: i64, key: *u8, def: *u8) -> *u8 {
  let kn: i64 = cjx_slen(key)
  var i: i64 = 0
  while i < n {
      var e: i64 = i
      var go: i64 = 1
      while go == 1 { if e >= n { go = 0 } else { if cjp_nl(cf, e) == 1 { go = 0 } else { e = e + 1 } } }
      if (cf[i] as i64) != CJX_HASH {
          if e - i > kn {
              var k: i64 = 0
              var hit: i64 = 1
              while k < kn { if cf[i+k] != key[k] { hit = 0; k = kn } if hit == 1 { k = k + 1 } }
              if hit == 1 { if (cf[i+kn] as i64) == 61 {
                  var q: i64 = i + kn + 1
                  var ln: i64 = e - q
                  if ln > 0 { if (cf[e-1] as i64) == CJX_CR { ln = ln - 1 } }
                  if ln > 0 {
                      let d: *u8 = sys_mmap(ln + 1)
                      var c: i64 = 0
                      while c < ln { d[c] = cf[q+c]; c = c + 1 }
                      d[ln] = 0 as u8
                      return d
                  }
              } }
          }
      }
      i = e + 1
  }
  return def
278}
279
280// FNV-1a over a string: a stable, collision-poor name for a per-image scratch file (no getpid in the
281// syscall surface; two concurrent panels over the SAME image path would share a scratch name -- declared).
282func cjp_fnv(s: *u8) -> i64 {
  var h: i64 = CJP_FNV_BASIS
  var i: i64 = 0
  while s[i] != (0 as u8) {
      h = h ^ (s[i] as i64)
      h = (h * CJP_FNV_PRIME) & CJP_FNV_MASK
      i = i + 1
  }
  return h
291}
292func cjp_hex8(d: *u8, o: i64, v: i64) -> i64 {
  var k: i64 = 7
  var p: i64 = o
  while k >= 0 {
      let nib: i64 = (v >> (k*4)) & 15
      if nib < 10 { d[p] = (CJX_D0 + nib) as u8 } else { d[p] = (87 + nib) as u8 }
      p = p + 1
      k = k - 1
  }
  d[p] = 0 as u8
  return p
303}
304
305// ONE corner-background estimator for the lens child and figcrop (the duplicate-ruler law: two copies of
306// "what is the background" would drift apart). Mean of the four pixels `inset` px inside each corner
307// (clamped so a tiny image still samples inside itself); out3 = r,g,b.
308func cjp_corner_bg(rgb: *u8, w: i64, h: i64, inset: i64, out3: *i64) -> i64 {
  var ins: i64 = inset
  if ins < 0 { ins = 0 }
  if ins * 2 >= w { ins = (w - 1) / 2 }
  if ins * 2 >= h { ins = (h - 1) / 2 }
  var sr: i64 = 0
  var sg: i64 = 0
  var sb: i64 = 0
  var ci: i64 = 0
  while ci < 4 {
      var cx: i64 = ins
      var cy: i64 = ins
      if ci == 1 { cx = w - 1 - ins }
      if ci == 2 { cy = h - 1 - ins }
      if ci == 3 { cx = w - 1 - ins; cy = h - 1 - ins }
      let o: i64 = (cy*w + cx) * 3
      sr = sr + (rgb[o] as i64)
      sg = sg + (rgb[o+1] as i64)
      sb = sb + (rgb[o+2] as i64)
      ci = ci + 1
  }
  out3[0] = sr / 4
  out3[1] = sg / 4
  out3[2] = sb / 4
  return 0
333}
334
335// ---- THE PER-IMAGE CHILD: decode once, every lens, one anchored line --------------------------------
336// Prints: CJP-LENS path=<p> src_w= src_h= fit_w= fit_h= cjp_stats= cjp_comp= cjp_pal= cjp_cont= cjp_face=
337//         cjp_skin_all= cjp_skin_center= cjp_skin_fig= cjp_fig_permil= cjp_sym= cjp_percept= cjp_vlm=
338// Every cjp_* key appears exactly once. -1 on a permil lens and CJP_UNOBS on percept mean UNOBSERVABLE.
339func cjp_lens(path: *u8, confp: *u8) -> i64 {
  let cfl: *i64 = sys_mmap(16) as *i64
  cfl[0] = 0
  var cf: *u8 = sys_read_file(confp, cfl)
  var cfn: i64 = 0
  if (cf as i64) != 0 { cfn = cfl[0] } else { cf = sys_mmap(16); cf[0] = 0 as u8 }
  let fnd: *i64 = sys_mmap(16) as *i64
  let pw: i64 = cjp_conf_int(cf, cfn, "percept_w" as *u8, CJP_DEF_PERCEPT_W, fnd)
  let ph: i64 = cjp_conf_int(cf, cfn, "percept_h" as *u8, CJP_DEF_PERCEPT_H, fnd)
  let center_permil: i64 = cjp_conf_int(cf, cfn, "center_permil" as *u8, CJP_DEF_CENTER_PERMIL, fnd)
  let bg_tol: i64 = cjp_conf_int(cf, cfn, "bg_tol" as *u8, CJP_DEF_BG_TOL, fnd)
  let elf_cj: *u8 = cjp_conf_str(cf, cfn, "elf_charjudge" as *u8, "./nx_charjudge.elf" as *u8)
  let elf_ib: *u8 = cjp_conf_str(cf, cfn, "elf_beauty" as *u8, "./nx_image_beauty.elf" as *u8)
  let elf_pj: *u8 = cjp_conf_str(cf, cfn, "elf_percept" as *u8, "./nx_percept.elf" as *u8)
  let tmpdir: *u8 = cjp_conf_str(cf, cfn, "tmp_dir" as *u8, "/tmp" as *u8)
354
  // 1. decode ONCE through the estate's single decode chokepoint
  let wh: *i64 = sys_mmap(32) as *i64
  wh[0] = 0
  wh[1] = 0
  let rgb: *u8 = nx_img_to_rgb(path, wh)
  cjx_p("CJP-LENS path=" as *u8); cjx_p(path)
  if (rgb as i64) == 0 {
      cjx_p(" decoded=0 src_w=0 src_h=0 fit_w=0 fit_h=0 cjp_stats=-1 cjp_comp=-1 cjp_pal=-1 cjp_cont=-1 cjp_face=-1 cjp_skin_all=-1 cjp_skin_center=-1 cjp_skin_fig=-1 cjp_kc_all=-1 cjp_kc_center=-1 cjp_kc_fig=-1 cjp_cn_all=-1 cjp_cn_center=-1 cjp_cn_fig=-1 cjp_fig_permil=-1 cjp_sym=-1 cjp_percept=-9999 cjp_vlm=-1 note=undecodable\n" as *u8)
      return 2
  }
  let w: i64 = wh[0]
  let h: i64 = wh[1]
  if w <= 0 { cjx_p(" decoded=0 src_w=0 src_h=0 note=zero-width\n" as *u8); return 2 }
  if h <= 0 { cjx_p(" decoded=0 src_w=0 src_h=0 note=zero-height\n" as *u8); return 2 }
369
  // 2. fit-resample into the percept frame (box filter, aspect kept, centred, padded with the image's own
  //    corner-mean colour so no artificial black bar reads as a flat-junk region). The in-process lenses
  //    run on the fitted region only -- bounded cost whatever the source size, proportions preserved.
  var fw: i64 = pw
  var fh: i64 = ph
  if w * ph >= h * pw { fh = h * pw / w; if fh < 1 { fh = 1 } } else { fw = w * ph / h; if fw < 1 { fw = 1 } }
  let ox: i64 = (pw - fw) / 2
  let oy: i64 = (ph - fh) / 2
  // corner-mean background (inset past any 1-px canvas border a capture may carry)
  let bg_inset: i64 = cjp_conf_int(cf, cfn, "bg_inset_px" as *u8, CJP_DEF_BG_INSET_PX, fnd)
  let bg3: *i64 = sys_mmap(32) as *i64
  cjp_corner_bg(rgb, w, h, bg_inset, bg3)
  let bgr: i64 = bg3[0]
  let bgg: i64 = bg3[1]
  let bgb: i64 = bg3[2]
  let fb: *i64 = sys_mmap(pw*ph*8) as *i64
  var pi: i64 = 0
  while pi < pw*ph { fb[pi] = bgr + bgg*CJP_BYTE + bgb*CJP_BYTE*CJP_BYTE; pi = pi + 1 }
  // skin + figure tallies over the fitted region.
  // THREE SKIN RULERS ARE TALLIED SIDE BY SIDE, ALWAYS, whichever one votes (conf: skin_rule):
  //   n_skin_* = Kovac daylight rule (the incumbent, luminance-gated) -- kept so the incumbent stays runnable
  //   n_kc_*   = the same published Cb/Cr window with the luminance gate dropped (grading-invariant)
  //   n_cn_*   = Chai & Ngan 1999 skin-colour map, chroma-only as published (grading-invariant)
  // Reporting all three on every line is what lets the ruler be CHOSEN on measured separability
  // rather than on taste, and lets a later reader re-adjudicate that choice without a rebuild.
  // The scratch struct is hoisted HERE, above the loop: nx_color_skin_flags_at allocates nothing.
  let ycc: *YCbCrColor = (sys_mmap(24)) as *YCbCrColor
  var n_all: i64 = 0
  var n_skin_all: i64 = 0
  var n_center: i64 = 0
  var n_skin_center: i64 = 0
  var n_fig: i64 = 0
  var n_skin_fig: i64 = 0
  var n_kc_all: i64 = 0
  var n_kc_center: i64 = 0
  var n_kc_fig: i64 = 0
  var n_cn_all: i64 = 0
  var n_cn_center: i64 = 0
  var n_cn_fig: i64 = 0
  let cx0: i64 = fw * (1000 - center_permil) / 2000
  let cx1: i64 = fw - cx0
  let cy0: i64 = fh * (1000 - center_permil) / 2000
  let cy1: i64 = fh - cy0
  var ty: i64 = 0
  while ty < fh {
      let sy0: i64 = ty * h / fh
      var sy1: i64 = (ty + 1) * h / fh
      if sy1 <= sy0 { sy1 = sy0 + 1 }
      var tx: i64 = 0
      while tx < fw {
          let sx0: i64 = tx * w / fw
          var sx1: i64 = (tx + 1) * w / fw
          if sx1 <= sx0 { sx1 = sx0 + 1 }
          var sr: i64 = 0
          var sg: i64 = 0
          var sb: i64 = 0
          var cnt: i64 = 0
          var yy: i64 = sy0
          while yy < sy1 {
              var xx: i64 = sx0
              while xx < sx1 {
                  let o2: i64 = (yy*w + xx) * 3
                  sr = sr + (rgb[o2] as i64)
                  sg = sg + (rgb[o2+1] as i64)
                  sb = sb + (rgb[o2+2] as i64)
                  cnt = cnt + 1
                  xx = xx + 1
              }
              yy = yy + 1
          }
          let r: i64 = sr / cnt
          let g: i64 = sg / cnt
          let b: i64 = sb / cnt
          fb[(oy+ty)*pw + ox + tx] = r + g*CJP_BYTE + b*CJP_BYTE*CJP_BYTE
          // ONE conversion, three predicates. Flag sum: 1 = Kovac daylight, 2 = chroma-only, 4 = locus.
          // Decoded by / and % rather than a mask so no bitwise operator is required.
          let skf: i64 = nx_color_skin_flags_at(r, g, b, ycc)
          let sk: i64 = skf % 2
          let skc: i64 = (skf / 2) % 2
          let skl: i64 = (skf / 4) % 2
          n_all = n_all + 1
          n_skin_all = n_skin_all + sk
          n_kc_all = n_kc_all + skc
          n_cn_all = n_cn_all + skl
          var incenter: i64 = 0
          if tx >= cx0 { if tx < cx1 { if ty >= cy0 { if ty < cy1 { incenter = 1 } } } }
          if incenter == 1 { n_center = n_center + 1; n_skin_center = n_skin_center + sk; n_kc_center = n_kc_center + skc; n_cn_center = n_cn_center + skl }
          var dmax: i64 = r - bgr
          if dmax < 0 { dmax = 0 - dmax }
          var dg: i64 = g - bgg
          if dg < 0 { dg = 0 - dg }
          var db: i64 = b - bgb
          if db < 0 { db = 0 - db }
          if dg > dmax { dmax = dg }
          if db > dmax { dmax = db }
          if dmax > bg_tol { n_fig = n_fig + 1; n_skin_fig = n_skin_fig + sk; n_kc_fig = n_kc_fig + skc; n_cn_fig = n_cn_fig + skl }
          tx = tx + 1
      }
      ty = ty + 1
  }
  var skin_all: i64 = 0
  if n_all > 0 { skin_all = n_skin_all * CJX_PERMIL_MAX / n_all }
  var skin_center: i64 = 0 - 1
  if n_center > 0 { skin_center = n_skin_center * CJX_PERMIL_MAX / n_center }
  var skin_fig: i64 = 0 - 1
  if n_fig > 0 { skin_fig = n_skin_fig * CJX_PERMIL_MAX / n_fig }
  // the two grading-invariant rulers, same three regions, same denominators
  var kc_all: i64 = 0
  if n_all > 0 { kc_all = n_kc_all * CJX_PERMIL_MAX / n_all }
  var kc_center: i64 = 0 - 1
  if n_center > 0 { kc_center = n_kc_center * CJX_PERMIL_MAX / n_center }
  var kc_fig: i64 = 0 - 1
  if n_fig > 0 { kc_fig = n_kc_fig * CJX_PERMIL_MAX / n_fig }
  var cn_all: i64 = 0
  if n_all > 0 { cn_all = n_cn_all * CJX_PERMIL_MAX / n_all }
  var cn_center: i64 = 0 - 1
  if n_center > 0 { cn_center = n_cn_center * CJX_PERMIL_MAX / n_center }
  var cn_fig: i64 = 0 - 1
  if n_fig > 0 { cn_fig = n_cn_fig * CJX_PERMIL_MAX / n_fig }
  var fig_permil: i64 = 0
  if n_all > 0 { fig_permil = n_fig * CJX_PERMIL_MAX / n_all }
491
  // 3. the forked lenses
  let out: *u8 = sys_mmap(CJX_OUTCAP)
  let olen: *i64 = sys_mmap(16) as *i64
  let trunc: *i64 = sys_mmap(16) as *i64
  let av: *i64 = sys_mmap(CJP_CHILD_ARGV*8) as *i64
  // stats: ./nx_charjudge.elf <path> <label>
  av[0] = elf_cj as i64
  av[1] = path as i64
  av[2] = "panel" as *u8 as i64
  av[3] = 0
  olen[0] = 0
  tr_run_capture_tr(elf_cj, av, out, CJX_OUTCAP, olen, CJX_TIMEOUT_MS, trunc)
  var stats: i64 = 0 - 1
  var comp: i64 = 0 - 1
  var pal: i64 = 0 - 1
  var cont: i64 = 0 - 1
  var face: i64 = 0 - 1
  if olen[0] > 0 {
      stats = cjx_field(out, olen[0], "\x22CHARJUDGE\x22:" as *u8)
      comp = cjx_field(out, olen[0], "\x22composition\x22:" as *u8)
      pal = cjx_field(out, olen[0], "\x22palette_axis\x22:" as *u8)
      cont = cjx_field(out, olen[0], "\x22contour_axis\x22:" as *u8)
      face = cjx_field(out, olen[0], "\x22face_axis\x22:" as *u8)
  }
  // sym: ./nx_image_beauty.elf path <png>
  av[0] = elf_ib as i64
  av[1] = "path" as *u8 as i64
  av[2] = path as i64
  av[3] = 0
  olen[0] = 0
  tr_run_capture_tr(elf_ib, av, out, CJX_OUTCAP, olen, CJX_TIMEOUT_MS, trunc)
  var sym: i64 = 0 - 1
  if olen[0] > 0 { sym = cjx_field(out, olen[0], "\x22symmetry_q1000\x22:" as *u8) }
  // percept: write the fitted frame as NXFH1 (the shared codec), fork ./nx_percept.elf judge <nxfh>, unlink
  let tmp: *u8 = sys_mmap(CJX_PATHCAP)
  var to: i64 = cjx_cat(tmp, 0, tmpdir)
  to = cjx_cat(tmp, to, "/cjp_lens_" as *u8)
  to = cjp_hex8(tmp, to, cjp_fnv(path))
  to = cjx_cat(tmp, to, ".nxfh" as *u8)
  var percept: i64 = CJP_UNOBS
  let wrote: i64 = nxl_dump(tmp, fb, pw, ph)
  if wrote > 0 {
      av[0] = elf_pj as i64
      av[1] = "judge" as *u8 as i64
      av[2] = tmp as i64
      av[3] = 0
      olen[0] = 0
      tr_run_capture_tr(elf_pj, av, out, CJX_OUTCAP, olen, CJX_TIMEOUT_MS, trunc)
      if olen[0] > 0 { percept = cjx_sfield(out, olen[0], "\x22score\x22:" as *u8, CJP_UNOBS) }
      sys_unlinkat(tmp)
  }
  // vlm: no sovereign VLM oracle exists on the estate (measured 2026-08-19). The slot abstains.
  let vlm: i64 = 0 - 1
545
  cjx_p(" decoded=1 src_w=" as *u8); cjx_n(w)
  cjx_p(" src_h=" as *u8); cjx_n(h)
  cjx_p(" fit_w=" as *u8); cjx_n(fw)
  cjx_p(" fit_h=" as *u8); cjx_n(fh)
  cjx_p(" cjp_stats=" as *u8); cjx_n(stats)
  cjx_p(" cjp_comp=" as *u8); cjx_n(comp)
  cjx_p(" cjp_pal=" as *u8); cjx_n(pal)
  cjx_p(" cjp_cont=" as *u8); cjx_n(cont)
  cjx_p(" cjp_face=" as *u8); cjx_n(face)
  cjx_p(" cjp_skin_all=" as *u8); cjx_n(skin_all)
  cjx_p(" cjp_skin_center=" as *u8); cjx_n(skin_center)
  cjx_p(" cjp_skin_fig=" as *u8); cjx_n(skin_fig)
  cjx_p(" cjp_kc_all=" as *u8); cjx_n(kc_all)
  cjx_p(" cjp_kc_center=" as *u8); cjx_n(kc_center)
  cjx_p(" cjp_kc_fig=" as *u8); cjx_n(kc_fig)
  cjx_p(" cjp_cn_all=" as *u8); cjx_n(cn_all)
  cjx_p(" cjp_cn_center=" as *u8); cjx_n(cn_center)
  cjx_p(" cjp_cn_fig=" as *u8); cjx_n(cn_fig)
  cjx_p(" cjp_fig_permil=" as *u8); cjx_n(fig_permil)
  cjx_p(" cjp_sym=" as *u8); cjx_n(sym)
  cjx_p(" cjp_percept=" as *u8); cjx_n(percept)
  cjx_p(" cjp_vlm=" as *u8); cjx_n(vlm)
  cjx_p(" vlm=UNOBSERVABLE\n" as *u8)
  return 0
570}
571
572// ---- receipt: the admission contract, bound to the floors it was measured at ----------------------
573// Format (one key per line): admitted= fp= fn= good= bad= epoch= floors=<stats>,<skin>,<sym>,<percept>
574// A floor that was REPORT-ONLY at calibration is written as the word `none`, so a later conf edit that
575// ADDS a floor also un-admits (the set of voting lenses changed, so the FP/FN measured no longer apply).
576// ---- AT8 (aesthetictwin): THE FIDELITY TIER OF THE SUBJECT. --------------------------------------
577// A floor is never a number on its own -- it is a number ABOUT a measurement, which is why this file
578// already binds the skin REGION and the skin RULER into the receipt. The fidelity TIER of the rendered
579// subject is the third such dimension, and it is the one the published record shows actually FLIPS the
580// answer rather than merely shifting it: the optimally attractive leg-to-body ratio sits fractionally
581// BELOW baseline on silhouettes and about half a standard deviation ABOVE it on detailed computer-
582// generated figures, with rater sensitivity lowest on silhouettes (Versluys and Skylark 2017, mirrored
583// and pinned as aesthetictwin.refs key versluys2017). A floor calibrated on one tier and applied to
584// another is therefore not a stricter or a looser bar -- it is a bar about a different question, and
585// this estate renders at clay while its far-bar references are photoreal.
586// ROW GRAMMAR, ADDITIVE: path<TAB>LABEL<TAB>TIER. A row with no third field takes the conf's
587// tier_default, so every list written before this rung means exactly what it meant before it.
588const CJP_TIERS: i64 = 4
589const CJP_T_SIL: i64 = 0
590const CJP_T_CLAY: i64 = 1
591const CJP_T_TEX: i64 = 2
592const CJP_T_PHOTO: i64 = 3
593func cjp_tier_of(s: *u8) -> i64 {
  if cjx_streq(s, "silhouette" as *u8) == 1 { return CJP_T_SIL }
  if cjx_streq(s, "clay" as *u8) == 1 { return CJP_T_CLAY }
  if cjx_streq(s, "textured" as *u8) == 1 { return CJP_T_TEX }
  if cjx_streq(s, "photoreal" as *u8) == 1 { return CJP_T_PHOTO }
  return 0 - 1
599}
600func cjp_tier_name(t: i64) -> *u8 {
  if t == CJP_T_SIL { return "silhouette" as *u8 }
  if t == CJP_T_CLAY { return "clay" as *u8 }
  if t == CJP_T_TEX { return "textured" as *u8 }
  if t == CJP_T_PHOTO { return "photoreal" as *u8 }
  return "?" as *u8
606}
607func cjp_lens_name(li: i64) -> *u8 {
  if li == CJP_L_STATS { return "stats" as *u8 }
  if li == CJP_L_SKIN { return "skin" as *u8 }
  if li == CJP_L_SYM { return "sym" as *u8 }
  if li == CJP_L_PERCEPT { return "percept" as *u8 }
  return "vlm" as *u8
613}
614// floor_<lens>_<tier>, built from the SAME name tables the reader prints, so the key parsed and the key
615// documented cannot drift apart.
616func cjp_tier_key(d: *u8, li: i64, t: i64) -> i64 {
  var p: i64 = cjx_cat(d, 0, "floor_" as *u8)
  p = cjx_cat(d, p, cjp_lens_name(li))
  p = cjx_cat(d, p, "_" as *u8)
  p = cjx_cat(d, p, cjp_tier_name(t))
  return p
622}
623// The tier SET as a stable canonical string -- what the receipt binds, so a corpus whose tier set moves
624// un-admits by construction exactly as a moved floor does.
625func cjp_tierset_str(d: *u8, o: i64, seen: *i64) -> i64 {
  var p: i64 = o
  var first: i64 = 1
  var t: i64 = 0
  while t < CJP_TIERS {
      if seen[t] == 1 {
          if first == 0 { p = cjx_cat(d, p, "," as *u8) }
          p = cjx_cat(d, p, cjp_tier_name(t))
          first = 0
      }
      t = t + 1
  }
  if first == 1 { p = cjx_cat(d, p, "none" as *u8) }
  return p
639}
640// WHOLE-TOKEN membership in a comma-separated set. Never a substring test: `clay` must not match
641// `clayish`, and a set test that matches a prefix is how an unadmitted tier would slip through.
642func cjp_tierset_has(s: *u8, name: *u8) -> i64 {
  var nl: i64 = 0
  while name[nl] != (0 as u8) { nl = nl + 1 }
  if nl == 0 { return 0 }
  var i: i64 = 0
  var go: i64 = 1
  while go == 1 {
      var k: i64 = 0
      var eq: i64 = 1
      while k < nl { if s[i+k] != name[k] { eq = 0; k = nl } else { k = k + 1 } }
      if eq == 1 {
          let after: i64 = s[i+nl] as i64
          if after == 0 { return 1 }
          if after == 44 { return 1 }
      }
      var scan: i64 = 1
      while scan == 1 {
          if s[i] == (0 as u8) { scan = 0; go = 0 } else {
              if (s[i] as i64) == 44 { i = i + 1; scan = 0 } else { i = i + 1 }
          }
      }
  }
  return 0
665}
666func cjp_floor_str(d: *u8, o: i64, has: i64, v: i64) -> i64 {
  if has == 0 { return cjx_cat(d, o, "none" as *u8) }
  return cjx_catn(d, o, v)
669}
670func cjp_floors_line(d: *u8, o: i64, has: *i64, fl: *i64) -> i64 {
  var p: i64 = cjx_cat(d, o, "floors=" as *u8)
  p = cjp_floor_str(d, p, has[CJP_L_STATS], fl[CJP_L_STATS]); p = cjx_cat(d, p, "," as *u8)
  p = cjp_floor_str(d, p, has[CJP_L_SKIN], fl[CJP_L_SKIN]); p = cjx_cat(d, p, "," as *u8)
  p = cjp_floor_str(d, p, has[CJP_L_SYM], fl[CJP_L_SYM]); p = cjx_cat(d, p, "," as *u8)
  p = cjp_floor_str(d, p, has[CJP_L_PERCEPT], fl[CJP_L_PERCEPT])
  return p
677}
678// Does the receipt say admitted=1 AND describe THE SAME MEASUREMENT we are about to make?
679//
680// A floor is not a number on its own -- it is a number ABOUT a specific measurement. The same
681// floor_skin means three different things under three different skin rulers, and three more under
682// three different regions. Binding only the floors therefore left two silent escapes: swapping
683// skin_lens or skin_rule kept admitted=1 while measuring something the calibration never saw.
684// All three are bound here, so any of them moving un-admits by construction.
685// on_list[0] receives the receipt's `list` so the caller can PUBLISH which corpus admitted it --
686// an admission is only evidence about the corpus it was measured on.
687// tadm[0] receives the receipt's `tiers_admitted` set (empty string when the receipt predates tiers).
688// A LEGACY RECEIPT IS NOT A PERMISSIVE ONE: an empty set means the caller must decide, and the caller
689// only lets it stand for a single-tier corpus -- because a receipt written before tiers existed can
690// only have been measured on whatever single question its corpus asked.
691func cjp_receipt_admits(rpath: *u8, floors: *u8, slens: *u8, srule: *u8, on_list: *i64, tadm: *i64) -> i64 {
  let rl: *i64 = sys_mmap(16) as *i64
  rl[0] = 0
  let rb: *u8 = sys_read_file(rpath, rl)
  if (rb as i64) == 0 { return 0 }
  let n: i64 = rl[0]
  let fnd: *i64 = sys_mmap(16) as *i64
  let adm: i64 = cjp_conf_int(rb, n, "admitted" as *u8, 0, fnd)
  if adm != 1 { return 0 }
  let rf: *u8 = cjp_conf_str(rb, n, "floors" as *u8, "" as *u8)
  // compare against the value part of our floors line ("floors=" stripped)
  let ours: *u8 = ((floors as i64) + 7) as *u8
  if cjx_streq(rf, ours) == 0 { return 0 }
  let rlens: *u8 = cjp_conf_str(rb, n, "skin_lens" as *u8, "" as *u8)
  if cjx_streq(rlens, slens) == 0 { return 0 }
  // A receipt written before skin_rule existed carries no such key and was, in fact, measured with
  // the incumbent Kovac ruler -- so `kovac` is the honest default here, not a permissive one.
  let rrule: *u8 = cjp_conf_str(rb, n, "skin_rule" as *u8, "kovac" as *u8)
  if cjx_streq(rrule, srule) == 0 { return 0 }
  on_list[0] = cjp_conf_str(rb, n, "list" as *u8, "?" as *u8) as i64
  tadm[0] = cjp_conf_str(rb, n, "tiers_admitted" as *u8, "" as *u8) as i64
  return 1
713}
714
715// ---- THE PANEL DRIVER (the watch symbol). mode 0 = panel, 1 = calibrate. ---------------------------
716// Returns: panel -> 0 clean / 1 leak-or-unjudged; calibrate -> 0 ADMITTED / 1 REFUSED / 2 unreadable.
717func cjc_panel(selfp: *u8, listp: *u8, confp: *u8, mode: i64) -> i64 {
  let lenp: *i64 = sys_mmap(16) as *i64
  lenp[0] = 0
  let lbuf: *u8 = sys_read_file(listp, lenp)
  if (lbuf as i64) == 0 {
      cjx_p("PANEL-REFUSED list-unreadable path=" as *u8); cjx_p(listp); cjx_p("\n" as *u8)
      return 2
  }
  let n: i64 = lenp[0]
  let cfl: *i64 = sys_mmap(16) as *i64
  cfl[0] = 0
  var cf: *u8 = sys_read_file(confp, cfl)
  var cfn: i64 = 0
  if (cf as i64) != 0 { cfn = cfl[0] } else { cf = sys_mmap(16); cf[0] = 0 as u8 }
  // floors (DATA). absent key => report-only lens.
  let has: *i64 = sys_mmap(CJP_LENSES*8) as *i64
  let fl: *i64 = sys_mmap(CJP_LENSES*8) as *i64
  let fnd: *i64 = sys_mmap(16) as *i64
  fl[CJP_L_STATS] = cjp_conf_int(cf, cfn, "floor_stats" as *u8, 0, fnd); has[CJP_L_STATS] = fnd[0]
  fl[CJP_L_SKIN] = cjp_conf_int(cf, cfn, "floor_skin" as *u8, 0, fnd); has[CJP_L_SKIN] = fnd[0]
  fl[CJP_L_SYM] = cjp_conf_int(cf, cfn, "floor_sym" as *u8, 0, fnd); has[CJP_L_SYM] = fnd[0]
  fl[CJP_L_PERCEPT] = cjp_conf_int(cf, cfn, "floor_percept" as *u8, 0, fnd); has[CJP_L_PERCEPT] = fnd[0]
  fl[CJP_L_VLM] = 0; has[CJP_L_VLM] = 0
  let skin_lens: *u8 = cjp_conf_str(cf, cfn, "skin_lens" as *u8, "center" as *u8)
  let skin_rule: *u8 = cjp_conf_str(cf, cfn, "skin_rule" as *u8, "kovac" as *u8)
  let rpath: *u8 = cjp_conf_str(cf, cfn, "receipt" as *u8, "knowledge/status/cjc_panel_admission.txt" as *u8)
  // AN UNRECOGNISED SELECTOR REFUSES; IT NEVER SILENTLY BECOMES THE INCUMBENT. A mistyped rule that
  // fell through to the default would measure one thing while the conf, the receipt and every reader
  // said another -- the silent class, in the one file that decides what the referee is measuring.
  var rule_ok: i64 = 0
  if cjx_streq(skin_rule, "kovac" as *u8) == 1 { rule_ok = 1 }
  if cjx_streq(skin_rule, "chroma" as *u8) == 1 { rule_ok = 1 }
  if cjx_streq(skin_rule, "locus" as *u8) == 1 { rule_ok = 1 }
  if rule_ok == 0 {
      cjx_p("PANEL-REFUSED unknown skin_rule=" as *u8); cjx_p(skin_rule)
      cjx_p(" -- expected kovac|chroma|locus (nothing measured)\n" as *u8)
      return 2
  }
  var lens_ok: i64 = 0
  if cjx_streq(skin_lens, "center" as *u8) == 1 { lens_ok = 1 }
  if cjx_streq(skin_lens, "all" as *u8) == 1 { lens_ok = 1 }
  if cjx_streq(skin_lens, "fig" as *u8) == 1 { lens_ok = 1 }
  if lens_ok == 0 {
      cjx_p("PANEL-REFUSED unknown skin_lens=" as *u8); cjx_p(skin_lens)
      cjx_p(" -- expected center|all|fig (nothing measured)\n" as *u8)
      return 2
  }
  // ---- AT8: the tier default, and floors that are ABOUT a tier. -------------------------------
  let tier_def_s: *u8 = cjp_conf_str(cf, cfn, "tier_default" as *u8, "clay" as *u8)
  let tier_def: i64 = cjp_tier_of(tier_def_s)
  if tier_def < 0 {
      cjx_p("PANEL-REFUSED unknown tier_default=" as *u8); cjx_p(tier_def_s)
      cjx_p(" -- expected silhouette|clay|textured|photoreal (nothing measured)\n" as *u8)
      return 2
  }
  // tfl/thas/texp are indexed lens*CJP_TIERS+tier. texp records whether the floor is EXPLICITLY
  // per-tier: the fall-back to the global floor is what keeps this rung additive on a single-tier
  // corpus, and is exactly what must never be leaned on once a corpus spans tiers.
  let tfl: *i64 = sys_mmap(CJP_LENSES*CJP_TIERS*8) as *i64
  let thas: *i64 = sys_mmap(CJP_LENSES*CJP_TIERS*8) as *i64
  let texp: *i64 = sys_mmap(CJP_LENSES*CJP_TIERS*8) as *i64
  let tkey: *u8 = sys_mmap(96)
  var tli: i64 = 0
  while tli < CJP_LENSES {
      var tti: i64 = 0
      while tti < CJP_TIERS {
          cjp_tier_key(tkey, tli, tti)
          let tv: i64 = cjp_conf_int(cf, cfn, tkey, 0, fnd)
          let tix: i64 = tli*CJP_TIERS + tti
          if fnd[0] == 1 { tfl[tix] = tv; thas[tix] = 1; texp[tix] = 1 } else { tfl[tix] = fl[tli]; thas[tix] = has[tli]; texp[tix] = 0 }
          tti = tti + 1
      }
      tli = tli + 1
  }
  // The lens-line keys, built ONCE from the same strings the receipt binds -- so the key parsed and
  // the rule declared cannot drift apart. ALL THREE rulers get a key for the CURRENT region, because
  // every run reports all three; skin_key is simply whichever one the conf selected to vote.
  var ksuf: *u8 = "_center=" as *u8
  if cjx_streq(skin_lens, "all" as *u8) == 1 { ksuf = "_all=" as *u8 }
  if cjx_streq(skin_lens, "fig" as *u8) == 1 { ksuf = "_fig=" as *u8 }
  let skkey: *i64 = sys_mmap(CJP_SKRULES*8) as *i64
  let kb0: *u8 = sys_mmap(64)
  let kb1: *u8 = sys_mmap(64)
  let kb2: *u8 = sys_mmap(64)
  cjx_cat(kb0, cjx_cat(kb0, 0, " cjp_skin" as *u8), ksuf)
  cjx_cat(kb1, cjx_cat(kb1, 0, " cjp_kc" as *u8), ksuf)
  cjx_cat(kb2, cjx_cat(kb2, 0, " cjp_cn" as *u8), ksuf)
  skkey[CJP_SK_KOVAC] = kb0 as i64
  skkey[CJP_SK_CHROMA] = kb1 as i64
  skkey[CJP_SK_LOCUS] = kb2 as i64
  var skin_key: *u8 = kb0
  if cjx_streq(skin_rule, "chroma" as *u8) == 1 { skin_key = kb1 }
  if cjx_streq(skin_rule, "locus" as *u8) == 1 { skin_key = kb2 }
  let floors: *u8 = sys_mmap(256)
  cjp_floors_line(floors, 0, has, fl)
  var voting: i64 = 0
  var li: i64 = 0
  while li < CJP_LENSES { voting = voting + has[li]; li = li + 1 }
  // ---- AT8 PRE-SCAN: read every row's TIER before anything is measured. A refusal about what the
  // measurement would have MEANT has to be reachable without having judged a single image, which is
  // why this is a separate pass over the list text and forks nothing.
  let tseen: *i64 = sys_mmap(CJP_TIERS*8) as *i64
  var tz: i64 = 0
  while tz < CJP_TIERS { tseen[tz] = 0; tz = tz + 1 }
  let tsc: *u8 = sys_mmap(CJX_PATHCAP)
  var si: i64 = 0
  while si < n {
      var se: i64 = si
      var sgo: i64 = 1
      while sgo == 1 {
          if se >= n { sgo = 0 }
          if sgo == 1 { if lbuf[se] == (CJX_NL as u8) { sgo = 0 } }
          if sgo == 1 { se = se + 1 }
      }
      var sln: i64 = se - si
      if sln > 0 { if lbuf[si] != (CJX_HASH as u8) {
          if sln > CJX_PATHCAP-1 { sln = CJX_PATHCAP-1 }
          var sk: i64 = 0
          while sk < sln { tsc[sk] = lbuf[si+sk]; sk = sk + 1 }
          if sln > 0 { if tsc[sln-1] == (CJX_CR as u8) { sln = sln - 1 } }
          tsc[sln] = 0 as u8
          var stabs: i64 = 0
          var st3: i64 = 0 - 1
          var sq: i64 = 0
          while sq < sln {
              if (tsc[sq] as i64) == CJX_TAB {
                  stabs = stabs + 1
                  tsc[sq] = 0 as u8
                  if stabs == 2 { st3 = sq + 1 }
              }
              sq = sq + 1
          }
          if tsc[0] != (0 as u8) {
              var srt: i64 = tier_def
              if st3 >= 0 { srt = cjp_tier_of(((tsc as i64) + st3) as *u8) }
              if srt < 0 {
                  cjx_p("PANEL-REFUSED unknown tier=" as *u8); cjx_p(((tsc as i64) + st3) as *u8)
                  cjx_p(" path=" as *u8); cjx_p(tsc)
                  cjx_p(" -- expected silhouette|clay|textured|photoreal (nothing measured)\n" as *u8)
                  return 2
              }
              tseen[srt] = 1
          }
      } }
      si = se + 1
  }
  var spans: i64 = 0
  tz = 0
  while tz < CJP_TIERS { spans = spans + tseen[tz]; tz = tz + 1 }
  let tset: *u8 = sys_mmap(128)
  cjp_tierset_str(tset, 0, tseen)
  // A LENS MAY VOTE ON A TIER ONLY WITH A FLOOR THAT IS ABOUT THAT TIER. On a single-tier corpus the
  // global floor IS about that tier, so nothing changes. The moment a corpus spans tiers, a global
  // floor would be one bar answering two different questions -- so it stops voting and says so, per
  // tier, rather than quietly deciding both.
  let tvote: *i64 = sys_mmap(CJP_LENSES*CJP_TIERS*8) as *i64
  let votingt: *i64 = sys_mmap(CJP_TIERS*8) as *i64
  tz = 0
  while tz < CJP_TIERS { votingt[tz] = 0; tz = tz + 1 }
  tli = 0
  while tli < CJP_LENSES {
      var tti2: i64 = 0
      while tti2 < CJP_TIERS {
          let vix: i64 = tli*CJP_TIERS + tti2
          var canv: i64 = 0
          if thas[vix] == 1 { if spans == 1 { canv = 1 } else { if texp[vix] == 1 { canv = 1 } } }
          tvote[vix] = canv
          votingt[tti2] = votingt[tti2] + canv
          tti2 = tti2 + 1
      }
      tli = tli + 1
  }
  var admitted: i64 = 0
  let onl: *i64 = sys_mmap(16) as *i64
  onl[0] = "?" as *u8 as i64
  let tadmp: *i64 = sys_mmap(16) as *i64
  tadmp[0] = "" as *u8 as i64
  if mode == 0 { admitted = cjp_receipt_admits(rpath, floors, skin_lens, skin_rule, onl, tadmp) }
  // A LEGACY RECEIPT (no tiers_admitted key) can only stand for a SINGLE-TIER corpus: it recorded an
  // admission for one question, and a multi-tier corpus asks more than one. Never widened silently.
  var legacy_receipt: i64 = 0
  if cjx_slen(tadmp[0] as *u8) == 0 { legacy_receipt = 1 }
899
  cjx_p("=== CJC PANEL list=" as *u8); cjx_p(listp)
  cjx_p(" conf=" as *u8); cjx_p(confp)
  cjx_p(" " as *u8); cjx_p(floors)
  cjx_p(" skin_lens=" as *u8); cjx_p(skin_lens)
  cjx_p(" skin_rule=" as *u8); cjx_p(skin_rule)
  cjx_p(" skin_key=" as *u8); cjx_p(skin_key)
  cjx_p(" voting_lenses=" as *u8); cjx_n(voting)
  // AT8: the tier set travels with every header, so a reader can never mistake which question the
  // floors below were answers to. spans>1 with only global floors is the cross-tier case.
  cjx_p(" tiers=" as *u8); cjx_p(tset)
  cjx_p(" spans=" as *u8); cjx_n(spans)
  cjx_p(" tier_default=" as *u8); cjx_p(tier_def_s)
  cjx_p(" tier_voting=" as *u8)
  tz = 0
  var tvfirst: i64 = 1
  while tz < CJP_TIERS {
      if tseen[tz] == 1 {
          if tvfirst == 0 { cjx_p("," as *u8) }
          cjx_p(cjp_tier_name(tz)); cjx_p(":" as *u8); cjx_n(votingt[tz])
          tvfirst = 0
      }
      tz = tz + 1
  }
  if tvfirst == 1 { cjx_p("none" as *u8) }
  // AN ADMISSION IS EVIDENCE ONLY ABOUT THE CORPUS IT WAS MEASURED ON, so the corpus travels with it.
  // Printing it is what makes a stale admission visible to a reader running a DIFFERENT list.
  if mode == 0 { if admitted == 1 { cjx_p(" admission=ADMITTED admitted_on=" as *u8); cjx_p(onl[0] as *u8) } else { cjx_p(" admission=UNADMITTED" as *u8) } }
  if mode == 1 { cjx_p(" admission=CALIBRATING" as *u8) }
  cjx_p("\n" as *u8)
929
  let path: *u8 = sys_mmap(CJX_PATHCAP)
  let out: *u8 = sys_mmap(CJP_CHILD_OUTCAP)
  let olen: *i64 = sys_mmap(16) as *i64
  let trunc: *i64 = sys_mmap(16) as *i64
  let av: *i64 = sys_mmap(CJP_CHILD_ARGV*8) as *i64
  var total: i64 = 0
  var judged: i64 = 0
  var failed: i64 = 0
  var truncated: i64 = 0
  var n_good: i64 = 0
  var n_bad: i64 = 0
  var n_unlab: i64 = 0
  // confusion per lens + composite: fp (BAD judged pass), fn (GOOD judged fail), unobs among labelled
  let fp: *i64 = sys_mmap((CJP_LENSES+1)*8) as *i64
  let fneg: *i64 = sys_mmap((CJP_LENSES+1)*8) as *i64
  let unob: *i64 = sys_mmap((CJP_LENSES+1)*8) as *i64
  // separation margins: min over GOOD, max over BAD, per lens (for the human who sets the floor)
  let gmin: *i64 = sys_mmap(CJP_LENSES*8) as *i64
  let bmax: *i64 = sys_mmap(CJP_LENSES*8) as *i64
  // per-SKIN-RULER margins, tracked for all three whatever the conf selected to vote, so ONE run
  // carries everything needed to adjudicate the ruler choice on evidence.
  let skgmin: *i64 = sys_mmap(CJP_SKRULES*8) as *i64
  let skbmax: *i64 = sys_mmap(CJP_SKRULES*8) as *i64
  let skval: *i64 = sys_mmap(CJP_SKRULES*8) as *i64
  li = 0
  while li <= CJP_LENSES { fp[li] = 0; fneg[li] = 0; unob[li] = 0; li = li + 1 }
  li = 0
  while li < CJP_LENSES { gmin[li] = 0 - CJP_UNOBS; bmax[li] = CJP_UNOBS; li = li + 1 }
  li = 0
  while li < CJP_SKRULES { skgmin[li] = 0 - CJP_UNOBS; skbmax[li] = CJP_UNOBS; li = li + 1 }
  // AT8: composite confusion PER TIER. A corpus that spans tiers is several calibrations wearing one
  // filename, so each tier earns (or fails to earn) its admission on its own rows.
  let fpt: *i64 = sys_mmap(CJP_TIERS*8) as *i64
  let fnt: *i64 = sys_mmap(CJP_TIERS*8) as *i64
  let unobt: *i64 = sys_mmap(CJP_TIERS*8) as *i64
  let goodt: *i64 = sys_mmap(CJP_TIERS*8) as *i64
  let badt: *i64 = sys_mmap(CJP_TIERS*8) as *i64
  tz = 0
  while tz < CJP_TIERS { fpt[tz] = 0; fnt[tz] = 0; unobt[tz] = 0; goodt[tz] = 0; badt[tz] = 0; tz = tz + 1 }
  let vals: *i64 = sys_mmap(CJP_LENSES*8) as *i64
970
  var i: i64 = 0
  while i < n {
      var e: i64 = i
      var go: i64 = 1
      while go == 1 {
          if e >= n { go = 0 }
          if go == 1 { if lbuf[e] == (CJX_NL as u8) { go = 0 } }
          if go == 1 { e = e + 1 }
      }
      var ln: i64 = e - i
      if ln > 0 { if lbuf[i] != (CJX_HASH as u8) {
          if ln > CJX_PATHCAP-1 { ln = CJX_PATHCAP-1 }
          // split path<TAB>label
          var k: i64 = 0
          var tab: i64 = 0 - 1
          while k < ln {
              path[k] = lbuf[i+k]
              if tab < 0 { if (lbuf[i+k] as i64) == CJX_TAB { tab = k } }
              k = k + 1
          }
          if ln > 0 { if path[ln-1] == (CJX_CR as u8) { ln = ln - 1 } }
          path[ln] = 0 as u8
          var label: i64 = CJP_LABEL_NONE
          var plen: i64 = ln
          var rtier: i64 = tier_def
          if tab >= 0 {
              plen = tab
              path[tab] = 0 as u8
              let lc: i64 = path[tab+1] as i64
              if lc == 71 { label = CJP_LABEL_GOOD }      // 'G'OOD
              if lc == 66 { label = CJP_LABEL_BAD }       // 'B'AD
              // AT8: the optional THIRD field is the fidelity tier. The pre-scan has already refused
              // an unrecognised one with nothing measured, so any name arriving here resolves.
              var t2: i64 = tab + 1
              while t2 < ln {
                  if (path[t2] as i64) == CJX_TAB {
                      path[t2] = 0 as u8
                      rtier = cjp_tier_of(((path as i64) + t2 + 1) as *u8)
                      t2 = ln
                  } else { t2 = t2 + 1 }
              }
              if rtier < 0 { rtier = tier_def }
          }
          if plen > 0 {
              total = total + 1
              av[0] = selfp as i64
              av[1] = "lens" as *u8 as i64
              av[2] = path as i64
              av[3] = confp as i64
              av[4] = 0
              olen[0] = 0
              trunc[0] = 0
              let rc: i64 = tr_run_capture_tr(selfp, av, out, CJP_CHILD_OUTCAP, olen, CJX_TIMEOUT_MS*4, trunc)
              if trunc[0] != 0 { truncated = truncated + 1 }
              var dec: i64 = 0 - 1
              if olen[0] > 0 { dec = cjx_field(out, olen[0], " decoded=" as *u8) }
              if dec == 1 {
                  judged = judged + 1
                  vals[CJP_L_STATS] = cjx_sfield(out, olen[0], " cjp_stats=" as *u8, 0-1)
                  // Read ALL THREE rulers from the one lens line and track each one's margins.
                  // They cost nothing extra -- the child already measured them on the same pixels --
                  // and having them here is what makes the ruler choice re-auditable without a rebuild.
                  var sr: i64 = 0
                  while sr < CJP_SKRULES {
                      skval[sr] = cjx_sfield(out, olen[0], skkey[sr] as *u8, 0-1)
                      if label != CJP_LABEL_NONE { if skval[sr] >= 0 {
                          if label == CJP_LABEL_GOOD { if skval[sr] < skgmin[sr] { skgmin[sr] = skval[sr] } }
                          if label == CJP_LABEL_BAD { if skval[sr] > skbmax[sr] { skbmax[sr] = skval[sr] } }
                      } }
                      sr = sr + 1
                  }
                  vals[CJP_L_SKIN] = cjx_sfield(out, olen[0], skin_key, 0-1)
                  vals[CJP_L_SYM] = cjx_sfield(out, olen[0], " cjp_sym=" as *u8, 0-1)
                  vals[CJP_L_PERCEPT] = cjx_sfield(out, olen[0], " cjp_percept=" as *u8, CJP_UNOBS)
                  vals[CJP_L_VLM] = cjx_sfield(out, olen[0], " cjp_vlm=" as *u8, 0-1)
                  // votes: 1 pass / 0 fail / -1 abstain (unobservable or report-only)
                  var all_pass: i64 = 1
                  var any_fail: i64 = 0
                  var any_unobs: i64 = 0
                  var observed_voting: i64 = 0
                  cjx_p("{\x22path\x22:\x22" as *u8); cjx_p(path)
                  cjx_p("\x22,\x22label\x22:\x22" as *u8)
                  if label == CJP_LABEL_GOOD { cjx_p("GOOD" as *u8) }
                  if label == CJP_LABEL_BAD { cjx_p("BAD" as *u8) }
                  if label == CJP_LABEL_NONE { cjx_p("-" as *u8) }
                  cjx_p("\x22,\x22stats\x22:" as *u8); cjx_n(vals[CJP_L_STATS])
                  cjx_p(",\x22skin\x22:" as *u8); cjx_n(vals[CJP_L_SKIN])
                  cjx_p(",\x22sym\x22:" as *u8); cjx_n(vals[CJP_L_SYM])
                  cjx_p(",\x22percept\x22:" as *u8); cjx_n(vals[CJP_L_PERCEPT])
                  cjx_p(",\x22vlm\x22:" as *u8); cjx_n(vals[CJP_L_VLM])
                  cjx_p(",\x22votes\x22:\x22" as *u8)
                  li = 0
                  while li < CJP_LENSES {
                      var v: i64 = 0 - 1
                      var unobserved: i64 = 0
                      if li == CJP_L_PERCEPT { if vals[li] == CJP_UNOBS { unobserved = 1 } } else { if vals[li] < 0 { unobserved = 1 } }
                      // AT8: this lens votes on THIS image only with a floor that is about THIS
                      // image's tier. On a single-tier corpus that is the global floor and nothing
                      // moves; across tiers a global floor stops voting rather than answering two
                      // questions with one bar.
                      let vix2: i64 = li*CJP_TIERS + rtier
                      if tvote[vix2] == 1 {
                          if unobserved == 1 { any_unobs = 1; v = 0 - 1 } else {
                              observed_voting = observed_voting + 1
                              if vals[li] >= tfl[vix2] { v = 1 } else { v = 0; all_pass = 0; any_fail = 1 }
                          }
                      }
                      if v == 1 { cjx_p("P" as *u8) }
                      if v == 0 { cjx_p("F" as *u8) }
                      if v < 0 { if tvote[vix2] == 1 { cjx_p("?" as *u8) } else { cjx_p("." as *u8) } }
                      // per-lens confusion and margins on labelled rows (floor lenses only for fp/fneg;
                      // margins for every observed lens so a report-only lens can still be adjudicated)
                      if label != CJP_LABEL_NONE {
                          if unobserved == 0 {
                              if label == CJP_LABEL_GOOD { if vals[li] < gmin[li] { gmin[li] = vals[li] } }
                              if label == CJP_LABEL_BAD { if vals[li] > bmax[li] { bmax[li] = vals[li] } }
                          }
                          if tvote[vix2] == 1 {
                              if unobserved == 1 { unob[li] = unob[li] + 1 } else {
                                  if label == CJP_LABEL_GOOD { if vals[li] < tfl[vix2] { fneg[li] = fneg[li] + 1 } }
                                  if label == CJP_LABEL_BAD { if vals[li] >= tfl[vix2] { fp[li] = fp[li] + 1 } }
                              }
                          }
                      }
                      li = li + 1
                  }
                  cjx_p("\x22" as *u8)
                  // composite: AND over voting lenses; abstain if any voting lens was unobservable or none vote
                  var comp: i64 = 0 - 1        // -1 unobservable, 0 BAD, 1 GOOD
                  // AT8: the denominator is THIS TIER's voting lenses. A tier no lens can vote on is
                  // UNOBSERVABLE by construction -- abstain, never acquit with another tier's bar.
                  if votingt[rtier] > 0 {
                      if any_fail == 1 { comp = 0 } else { if any_unobs == 0 { if observed_voting == votingt[rtier] { comp = 1 } } }
                  }
                  if label != CJP_LABEL_NONE {
                      if comp < 0 { unob[CJP_LENSES] = unob[CJP_LENSES] + 1; unobt[rtier] = unobt[rtier] + 1 }
                      if comp == 1 { if label == CJP_LABEL_BAD { fp[CJP_LENSES] = fp[CJP_LENSES] + 1; fpt[rtier] = fpt[rtier] + 1 } }
                      if comp == 0 { if label == CJP_LABEL_GOOD { fneg[CJP_LENSES] = fneg[CJP_LENSES] + 1; fnt[rtier] = fnt[rtier] + 1 } }
                      if label == CJP_LABEL_GOOD { goodt[rtier] = goodt[rtier] + 1 }
                      if label == CJP_LABEL_BAD { badt[rtier] = badt[rtier] + 1 }
                  }
                  cjx_p(",\x22composite\x22:\x22" as *u8)
                  if comp == 1 { cjx_p("pass" as *u8) }
                  if comp == 0 { cjx_p("fail" as *u8) }
                  if comp < 0 { cjx_p("unobservable" as *u8) }
                  cjx_p("\x22,\x22tier\x22:\x22" as *u8); cjx_p(cjp_tier_name(rtier))
                  cjx_p("\x22,\x22verdict\x22:\x22" as *u8)
                  if mode == 0 {
                      // AT8: AN ADMISSION IS ABOUT A TIER. A receipt written before tiers existed
                      // carries no set and stands only for a single-tier corpus; otherwise this
                      // image's tier must be named in the admitted set or no verdict is returned.
                      var tier_adm: i64 = 0
                      if legacy_receipt == 1 { if spans == 1 { tier_adm = 1 } } else { tier_adm = cjp_tierset_has(tadmp[0] as *u8, cjp_tier_name(rtier)) }
                      if admitted == 1 {
                          if tier_adm == 1 {
                              if comp == 1 { cjx_p("GOOD" as *u8) }
                              if comp == 0 { cjx_p("BAD" as *u8) }
                              if comp < 0 { cjx_p("UNOBSERVABLE" as *u8) }
                          } else { cjx_p("TIER-UNADMITTED" as *u8) }
                      } else { cjx_p("UNADMITTED" as *u8) }
                  }
                  if mode == 1 { cjx_p("CALIBRATING" as *u8) }
                  cjx_p("\x22}\n" as *u8)
                  if label == CJP_LABEL_GOOD { n_good = n_good + 1 }
                  if label == CJP_LABEL_BAD { n_bad = n_bad + 1 }
                  if label == CJP_LABEL_NONE { n_unlab = n_unlab + 1 }
              }
              // A FAILURE IS NAMED, NEVER JUST COUNTED: rc and bytes separate a missing self/judge binary
              // (127, zero bytes) from an undecodable image (a CJP-LENS line with decoded=0).
              if dec != 1 {
                  failed = failed + 1
                  cjx_p("CJP-FAILED rc=" as *u8); cjx_n(rc)
                  cjx_p(" bytes=" as *u8); cjx_n(olen[0])
                  cjx_p(" path=" as *u8); cjx_p(path); cjx_p("\n" as *u8)
              }
          }
      } }
      i = e + 1
  }
  cjx_p("\n=== CJC PANEL CENSUS ===\n" as *u8)
  cjx_p("corpus=" as *u8); cjx_n(total)
  cjx_p(" judged=" as *u8); cjx_n(judged)
  cjx_p(" failed=" as *u8); cjx_n(failed)
  cjx_p(" truncated=" as *u8); cjx_n(truncated)
  cjx_p(" labelled_good=" as *u8); cjx_n(n_good)
  cjx_p(" labelled_bad=" as *u8); cjx_n(n_bad)
  cjx_p(" unlabelled=" as *u8); cjx_n(n_unlab)
  cjx_p("\n" as *u8)
  var recon: i64 = 0
  if judged + failed == total { if n_good + n_bad + n_unlab == judged { recon = 1 } }
  cjx_p("partition judged+failed=" as *u8); cjx_n(judged+failed)
  cjx_p(" corpus=" as *u8); cjx_n(total)
  cjx_p(" good+bad+unlabelled=" as *u8); cjx_n(n_good+n_bad+n_unlab)
  if recon == 1 { cjx_p(" RECONCILES\n" as *u8) }
  if recon == 0 { cjx_p(" LEAKS -- these numbers are not publishable\n" as *u8) }
  // margins: what the labelled corpus says about EVERY observed lens, floor or not
  if n_good + n_bad > 0 {
      cjx_p("margins (min over GOOD | max over BAD | separable?) per lens:\n" as *u8)
      li = 0
      while li < CJP_LENSES - 1 {
          cjx_p("  " as *u8)
          if li == CJP_L_STATS { cjx_p("stats  " as *u8) }
          if li == CJP_L_SKIN { cjx_p("skin   " as *u8) }
          if li == CJP_L_SYM { cjx_p("sym    " as *u8) }
          if li == CJP_L_PERCEPT { cjx_p("percept" as *u8) }
          cjx_p(" good_min=" as *u8)
          if gmin[li] == 0 - CJP_UNOBS { cjx_p("none" as *u8) } else { cjx_n(gmin[li]) }
          cjx_p(" bad_max=" as *u8)
          if bmax[li] == CJP_UNOBS { cjx_p("none" as *u8) } else { cjx_n(bmax[li]) }
          var sep: i64 = 0
          if gmin[li] != 0 - CJP_UNOBS { if bmax[li] != CJP_UNOBS { if gmin[li] > bmax[li] { sep = 1 } } }
          if sep == 1 { cjx_p(" separable=1" as *u8) } else { cjx_p(" separable=0" as *u8) }
          if has[li] == 1 {
              cjx_p(" floor=" as *u8); cjx_n(fl[li])
              cjx_p(" fp=" as *u8); cjx_n(fp[li])
              cjx_p(" fn=" as *u8); cjx_n(fneg[li])
              cjx_p(" unobservable=" as *u8); cjx_n(unob[li])
          } else { cjx_p(" floor=none (report-only)" as *u8) }
          cjx_p("\n" as *u8)
          li = li + 1
      }
      cjx_p("  vlm     UNOBSERVABLE -- no sovereign VLM oracle on the estate; the slot abstains by construction\n" as *u8)
      // THE RULER-CHOICE EVIDENCE, in the same run and over the same corpus, so which skin ruler
      // should vote is decided by measured separability rather than by taste -- and re-decidable
      // later without a rebuild, because every run carries all three.
      cjx_p("skin rulers on region " as *u8); cjx_p(skin_lens)
      cjx_p(" (min over GOOD | max over BAD | separable? | margin) -- voting: " as *u8); cjx_p(skin_rule); cjx_p("\n" as *u8)
      li = 0
      while li < CJP_SKRULES {
          cjx_p("  " as *u8)
          if li == CJP_SK_KOVAC { cjx_p("kovac  (daylight: Cb/Cr AND Y>80)   " as *u8) }
          if li == CJP_SK_CHROMA { cjx_p("chroma (Kovac Cb/Cr, NO luminance)  " as *u8) }
          if li == CJP_SK_LOCUS { cjx_p("locus  (Chai-Ngan 99, NO luminance) " as *u8) }
          cjx_p(" good_min=" as *u8)
          if skgmin[li] == 0 - CJP_UNOBS { cjx_p("none" as *u8) } else { cjx_n(skgmin[li]) }
          cjx_p(" bad_max=" as *u8)
          if skbmax[li] == CJP_UNOBS { cjx_p("none" as *u8) } else { cjx_n(skbmax[li]) }
          var ssep: i64 = 0
          if skgmin[li] != 0 - CJP_UNOBS { if skbmax[li] != CJP_UNOBS { if skgmin[li] > skbmax[li] { ssep = 1 } } }
          if ssep == 1 {
              cjx_p(" separable=1 margin=" as *u8); cjx_n(skgmin[li] - skbmax[li])
              cjx_p(" midpoint_floor=" as *u8); cjx_n((skgmin[li] + skbmax[li]) / 2)
          } else { cjx_p(" separable=0 margin=none midpoint_floor=none" as *u8) }
          cjx_p("\n" as *u8)
          li = li + 1
      }
  }
  if mode == 1 {
      // ADMISSION IS EARNED: both classes present, every labelled row observed by every voting lens,
      // composite FP=0 and FN=0, at least one voting lens. Then the receipt binds the floors.
      // AT8: ADMISSION IS EARNED PER TIER. Both classes present IN THAT TIER, every labelled row of
      // it observed by every lens that votes on it, and its composite FP and FN zero. A tier that
      // cannot separate is simply not admitted, and the panel then ABSTAINS on its images rather than
      // judging them against a bar calibrated on a different question.
      let admt: *i64 = sys_mmap(CJP_TIERS*8) as *i64
      var adm: i64 = 0
      tz = 0
      while tz < CJP_TIERS {
          var a1: i64 = 0
          if tseen[tz] == 1 { if votingt[tz] > 0 { if goodt[tz] > 0 { if badt[tz] > 0 { if recon == 1 {
              if fpt[tz] == 0 { if fnt[tz] == 0 { if unobt[tz] == 0 { a1 = 1 } } }
          } } } } }
          admt[tz] = a1
          adm = adm + a1
          tz = tz + 1
      }
      if adm > 1 { adm = 1 }
      let tadmset: *u8 = sys_mmap(128)
      cjp_tierset_str(tadmset, 0, admt)
      // The per-tier evidence prints whatever the outcome, and a tier that fails says WHY: a refusal
      // that will not name which tier failed and on how many rows is a count without a worklist.
      cjx_p("tiers per fidelity tier (good | bad | fp | fn | unobservable | lenses | admitted):\n" as *u8)
      tz = 0
      while tz < CJP_TIERS {
          if tseen[tz] == 1 {
              cjx_p("  " as *u8); cjx_p(cjp_tier_name(tz))
              cjx_p(" good=" as *u8); cjx_n(goodt[tz])
              cjx_p(" bad=" as *u8); cjx_n(badt[tz])
              cjx_p(" fp=" as *u8); cjx_n(fpt[tz])
              cjx_p(" fn=" as *u8); cjx_n(fnt[tz])
              cjx_p(" unobs=" as *u8); cjx_n(unobt[tz])
              cjx_p(" lenses=" as *u8); cjx_n(votingt[tz])
              cjx_p(" admitted=" as *u8); cjx_n(admt[tz])
              if admt[tz] == 0 {
                  cjx_p(" WHY=" as *u8)
                  if votingt[tz] == 0 { cjx_p("no-lens-votes-on-this-tier" as *u8) } else {
                      if goodt[tz] == 0 { cjx_p("no-GOOD-rows" as *u8) } else {
                          if badt[tz] == 0 { cjx_p("no-BAD-rows" as *u8) } else { cjx_p("does-not-separate" as *u8) }
                      }
                  }
              }
              cjx_p("\n" as *u8)
          }
          tz = tz + 1
      }
      cjx_p("calibration composite fp=" as *u8); cjx_n(fp[CJP_LENSES])
      cjx_p(" fn=" as *u8); cjx_n(fneg[CJP_LENSES])
      cjx_p(" unobservable=" as *u8); cjx_n(unob[CJP_LENSES])
      cjx_p(" good=" as *u8); cjx_n(n_good)
      cjx_p(" bad=" as *u8); cjx_n(n_bad)
      cjx_p(" voting_lenses=" as *u8); cjx_n(voting)
      cjx_p("\n" as *u8)
      let rb: *u8 = sys_mmap(CJP_RECEIPTCAP)
      var ro: i64 = cjx_cat(rb, 0, "# cjc_panel admission receipt -- written by nx_charjudge_census calibrate; bound to the floors below.\n# A conf whose floors differ from this line is UNADMITTED by construction (recalibrate).\nadmitted=" as *u8)
      ro = cjx_catn(rb, ro, adm)
      ro = cjx_cat(rb, ro, "\nfp=" as *u8); ro = cjx_catn(rb, ro, fp[CJP_LENSES])
      ro = cjx_cat(rb, ro, "\nfn=" as *u8); ro = cjx_catn(rb, ro, fneg[CJP_LENSES])
      ro = cjx_cat(rb, ro, "\nunobservable=" as *u8); ro = cjx_catn(rb, ro, unob[CJP_LENSES])
      ro = cjx_cat(rb, ro, "\ngood=" as *u8); ro = cjx_catn(rb, ro, n_good)
      ro = cjx_cat(rb, ro, "\nbad=" as *u8); ro = cjx_catn(rb, ro, n_bad)
      ro = cjx_cat(rb, ro, "\nvoting_lenses=" as *u8); ro = cjx_catn(rb, ro, voting)
      ro = cjx_cat(rb, ro, "\nlist=" as *u8); ro = cjx_cat(rb, ro, listp)
      ro = cjx_cat(rb, ro, "\nconf=" as *u8); ro = cjx_cat(rb, ro, confp)
      ro = cjx_cat(rb, ro, "\nskin_lens=" as *u8); ro = cjx_cat(rb, ro, skin_lens)
      ro = cjx_cat(rb, ro, "\nskin_rule=" as *u8); ro = cjx_cat(rb, ro, skin_rule)
      // AT8: the tier set the corpus presented, the subset that EARNED admission, and every floor that
      // is explicitly about a tier. All three are bound, so a corpus whose tiers move, or a tier that
      // stops separating, un-admits by construction exactly as a moved floor does.
      ro = cjx_cat(rb, ro, "\ntiers=" as *u8); ro = cjx_cat(rb, ro, tset)
      ro = cjx_cat(rb, ro, "\ntiers_admitted=" as *u8); ro = cjx_cat(rb, ro, tadmset)
      ro = cjx_cat(rb, ro, "\ntier_floors=" as *u8)
      var tfany: i64 = 0
      tli = 0
      while tli < CJP_LENSES {
          var tt3: i64 = 0
          while tt3 < CJP_TIERS {
              let eix: i64 = tli*CJP_TIERS + tt3
              if texp[eix] == 1 {
                  if tfany == 1 { ro = cjx_cat(rb, ro, "," as *u8) }
                  ro = cjx_cat(rb, ro, cjp_lens_name(tli)); ro = cjx_cat(rb, ro, "_" as *u8)
                  ro = cjx_cat(rb, ro, cjp_tier_name(tt3)); ro = cjx_cat(rb, ro, "=" as *u8)
                  ro = cjx_catn(rb, ro, tfl[eix])
                  tfany = 1
              }
              tt3 = tt3 + 1
          }
          tli = tli + 1
      }
      if tfany == 0 { ro = cjx_cat(rb, ro, "none" as *u8) }
      ro = cjx_cat(rb, ro, "\nepoch=" as *u8); ro = cjx_catn(rb, ro, sys_now_realtime_sec())
      ro = cjx_cat(rb, ro, "\n" as *u8); ro = cjx_cat(rb, ro, floors)
      ro = cjx_cat(rb, ro, "\n" as *u8)
      let fd: i64 = sys_openat_wr(rpath, CJP_MODE_644)
      if fd < 0 {
          cjx_p("RECEIPT-UNWRITABLE path=" as *u8); cjx_p(rpath); cjx_p("\n" as *u8)
          return 1
      }
      sys_write(fd, rb, ro)
      sys_close(fd)
      cjx_p("receipt=" as *u8); cjx_p(rpath)
      cjx_p(" bytes=" as *u8); cjx_n(ro)
      if adm == 1 { cjx_p(" ADMITTED -- the panel may return verdicts at these floors\n" as *u8); return 0 }
      cjx_p(" REFUSED -- the panel reports numbers only (fix the MECHANISM that fails to separate, never retune to fit)\n" as *u8)
      return 1
  }
  if recon == 0 { return 1 }
  if truncated > 0 { return 1 }
  if judged == 0 { cjx_p("headline UNMEASURED -- zero images judged\n" as *u8); return 1 }
  return 0
1330}
1331
1332// bank any decodable reference as PNG (the sibling judges decode PNG only): one decode, one encode.
1333func cjp_topng(inp: *u8, outp: *u8) -> i64 {
  let wh: *i64 = sys_mmap(32) as *i64
  wh[0] = 0
  wh[1] = 0
  let rgb: *u8 = nx_img_to_rgb(inp, wh)
  if (rgb as i64) == 0 { cjx_p("TOPNG-REFUSED undecodable path=" as *u8); cjx_p(inp); cjx_p("\n" as *u8); return 2 }
  if wh[0] <= 0 { cjx_p("TOPNG-REFUSED zero-dims\n" as *u8); return 2 }
  let rc: i64 = nx_png_write_rgb(outp, rgb, wh[0], wh[1])
  if rc != 0 { cjx_p("TOPNG-FAILED write path=" as *u8); cjx_p(outp); cjx_p("\n" as *u8); return 1 }
  cjx_p("TOPNG-OK src=" as *u8); cjx_p(inp)
  cjx_p(" w=" as *u8); cjx_n(wh[0])
  cjx_p(" h=" as *u8); cjx_n(wh[1])
  cjx_p(" dst=" as *u8); cjx_p(outp); cjx_p("\n" as *u8)
  return 0
1347}
1348
1349// SAME-FRAMING crop: the figure bbox over the FULL-RESOLUTION decode (the lens child works on a fitted frame;
1350// a crop must not inherit that downsample), margin = bbox-derived (crop_margin_permil of the larger side, conf),
1351// clamped to the image. Prints the bbox so the framing is auditable; REFUSES when no figure pixel exists
1352// (a crop of nothing would be the whole image wearing a new name).
1353func cjp_figcrop(inp: *u8, outp: *u8, confp: *u8) -> i64 {
  let cfl: *i64 = sys_mmap(16) as *i64
  cfl[0] = 0
  var cf: *u8 = sys_read_file(confp, cfl)
  var cfn: i64 = 0
  if (cf as i64) != 0 { cfn = cfl[0] } else { cf = sys_mmap(16); cf[0] = 0 as u8 }
  let fnd: *i64 = sys_mmap(16) as *i64
  let bg_tol: i64 = cjp_conf_int(cf, cfn, "bg_tol" as *u8, CJP_DEF_BG_TOL, fnd)
  let margin_permil: i64 = cjp_conf_int(cf, cfn, "crop_margin_permil" as *u8, CJP_DEF_CROP_MARGIN_PERMIL, fnd)
  let wh: *i64 = sys_mmap(32) as *i64
  wh[0] = 0
  wh[1] = 0
  let rgb: *u8 = nx_img_to_rgb(inp, wh)
  if (rgb as i64) == 0 { cjx_p("FIGCROP-REFUSED undecodable path=" as *u8); cjx_p(inp); cjx_p("\n" as *u8); return 2 }
  let w: i64 = wh[0]
  let h: i64 = wh[1]
  if w <= 0 { cjx_p("FIGCROP-REFUSED zero-dims\n" as *u8); return 2 }
  if h <= 0 { cjx_p("FIGCROP-REFUSED zero-dims\n" as *u8); return 2 }
  let bg_inset: i64 = cjp_conf_int(cf, cfn, "bg_inset_px" as *u8, CJP_DEF_BG_INSET_PX, fnd)
  // a capture's 1-px canvas border would otherwise BE the bbox: ignore an edge ring when scanning
  var edge_ignore: i64 = cjp_conf_int(cf, cfn, "edge_ignore_px" as *u8, CJP_DEF_EDGE_IGNORE_PX, fnd)
  if edge_ignore * 2 >= w { edge_ignore = 0 }
  if edge_ignore * 2 >= h { edge_ignore = 0 }
  let bg3: *i64 = sys_mmap(32) as *i64
  cjp_corner_bg(rgb, w, h, bg_inset, bg3)
  let bgr: i64 = bg3[0]
  let bgg: i64 = bg3[1]
  let bgb: i64 = bg3[2]
  var x0: i64 = w
  var y0: i64 = h
  var x1: i64 = 0 - 1
  var y1: i64 = 0 - 1
  var nfig: i64 = 0
  var y: i64 = edge_ignore
  while y < h - edge_ignore {
      var x: i64 = edge_ignore
      while x < w - edge_ignore {
          let o2: i64 = (y*w + x) * 3
          var d: i64 = (rgb[o2] as i64) - bgr
          if d < 0 { d = 0 - d }
          var dg: i64 = (rgb[o2+1] as i64) - bgg
          if dg < 0 { dg = 0 - dg }
          var db: i64 = (rgb[o2+2] as i64) - bgb
          if db < 0 { db = 0 - db }
          if dg > d { d = dg }
          if db > d { d = db }
          if d > bg_tol {
              nfig = nfig + 1
              if x < x0 { x0 = x }
              if x > x1 { x1 = x }
              if y < y0 { y0 = y }
              if y > y1 { y1 = y }
          }
          x = x + 1
      }
      y = y + 1
  }
  if nfig == 0 { cjx_p("FIGCROP-REFUSED no figure pixel differs from the corner background (bg_tol=" as *u8); cjx_n(bg_tol); cjx_p(") path=" as *u8); cjx_p(inp); cjx_p("\n" as *u8); return 1 }
  var side: i64 = x1 - x0 + 1
  if y1 - y0 + 1 > side { side = y1 - y0 + 1 }
  let m: i64 = side * margin_permil / CJX_PERMIL_MAX
  var cx0: i64 = x0 - m
  var cy0: i64 = y0 - m
  var cx1: i64 = x1 + m
  var cy1: i64 = y1 + m
  if cx0 < 0 { cx0 = 0 }
  if cy0 < 0 { cy0 = 0 }
  if cx1 > w - 1 { cx1 = w - 1 }
  if cy1 > h - 1 { cy1 = h - 1 }
  let cw: i64 = cx1 - cx0 + 1
  let chh: i64 = cy1 - cy0 + 1
  let out: *u8 = sys_mmap(cw*chh*3 + 16)
  var yy: i64 = 0
  while yy < chh {
      var xx: i64 = 0
      while xx < cw {
          let so: i64 = ((cy0+yy)*w + cx0 + xx) * 3
          let do2: i64 = (yy*cw + xx) * 3
          out[do2] = rgb[so]
          out[do2+1] = rgb[so+1]
          out[do2+2] = rgb[so+2]
          xx = xx + 1
      }
      yy = yy + 1
  }
  let rc: i64 = nx_png_write_rgb(outp, out, cw, chh)
  if rc != 0 { cjx_p("FIGCROP-FAILED write path=" as *u8); cjx_p(outp); cjx_p("\n" as *u8); return 1 }
  cjx_p("FIGCROP-OK src=" as *u8); cjx_p(inp)
  cjx_p(" src_w=" as *u8); cjx_n(w); cjx_p(" src_h=" as *u8); cjx_n(h)
  cjx_p(" fig_pixels=" as *u8); cjx_n(nfig)
  cjx_p(" bbox=" as *u8); cjx_n(x0); cjx_p("," as *u8); cjx_n(y0); cjx_p("," as *u8); cjx_n(x1); cjx_p("," as *u8); cjx_n(y1)
  cjx_p(" margin=" as *u8); cjx_n(m)
  cjx_p(" crop_w=" as *u8); cjx_n(cw); cjx_p(" crop_h=" as *u8); cjx_n(chh)
  cjx_p(" dst=" as *u8); cjx_p(outp); cjx_p("\n" as *u8)
  return 0
1448}
1449
1450func main(argc: i64, argv: *i64) -> i64 {
  if argc < 2 { cjx_p("usage: nx_charjudge_census <list-file> [judge-elf] | panel <list> [conf] | calibrate <labelled-list> [conf] | lens <image> [conf] | topng <in> <out.png> | figcrop <in> <out.png> [conf]\n" as *u8); return 3 }
  let a1: *u8 = argv[1] as *u8
  var confp: *u8 = "knowledge/cjc_panel.conf" as *u8
  if cjx_streq(a1, "lens" as *u8) == 1 {
      if argc < 3 { cjx_p("usage: nx_charjudge_census lens <image> [conf]\n" as *u8); return 3 }
      if argc >= 4 { confp = argv[3] as *u8 }
      return cjp_lens(argv[2] as *u8, confp)
  }
  if cjx_streq(a1, "panel" as *u8) == 1 {
      if argc < 3 { cjx_p("usage: nx_charjudge_census panel <list> [conf]\n" as *u8); return 3 }
      if argc >= 4 { confp = argv[3] as *u8 }
      return cjc_panel(argv[0] as *u8, argv[2] as *u8, confp, 0)
  }
  if cjx_streq(a1, "calibrate" as *u8) == 1 {
      if argc < 3 { cjx_p("usage: nx_charjudge_census calibrate <labelled-list> [conf]\n" as *u8); return 3 }
      if argc >= 4 { confp = argv[3] as *u8 }
      return cjc_panel(argv[0] as *u8, argv[2] as *u8, confp, 1)
  }
  if cjx_streq(a1, "topng" as *u8) == 1 {
      if argc < 4 { cjx_p("usage: nx_charjudge_census topng <in> <out.png>\n" as *u8); return 3 }
      return cjp_topng(argv[2] as *u8, argv[3] as *u8)
  }
  if cjx_streq(a1, "figcrop" as *u8) == 1 {
      if argc < 4 { cjx_p("usage: nx_charjudge_census figcrop <in> <out.png> [conf]\n" as *u8); return 3 }
      if argc >= 5 { confp = argv[4] as *u8 }
      return cjp_figcrop(argv[2] as *u8, argv[3] as *u8, confp)
  }
  // ---- legacy census, byte-for-byte the 2026-08-15 behaviour ----
  let listp: *u8 = a1
  var elfp: *u8 = "./nx_charjudge.elf" as *u8
  if argc >= 3 { elfp = argv[2] as *u8 }
  let lenp: *i64 = sys_mmap(16) as *i64
  let lbuf: *u8 = sys_read_file(listp, lenp)
  if (lbuf as i64) == 0 {
      cjx_p("CENSUS-REFUSED list-unreadable path=" as *u8); cjx_p(listp); cjx_p("\n" as *u8)
      return 2
  }
  let n: i64 = lenp[0]
  let path: *u8 = sys_mmap(CJX_PATHCAP)
  let out: *u8 = sys_mmap(CJX_OUTCAP)
  let olen: *i64 = sys_mmap(16) as *i64
  let trunc: *i64 = sys_mmap(16) as *i64
  let av: *i64 = sys_mmap(CJX_ARGV_SLOTS*8) as *i64
  var total: i64 = 0
  var judged: i64 = 0
  var failed: i64 = 0
  var truncated: i64 = 0
  var sum: i64 = 0
  var mn: i64 = CJX_PERMIL_MAX + 1
  var mx: i64 = 0-1
  var i: i64 = 0
  while i < n {
      var e: i64 = i
      var go: i64 = 1
      while go == 1 {
          if e >= n { go = 0 }
          if go == 1 { if lbuf[e] == (CJX_NL as u8) { go = 0 } }
          if go == 1 { e = e + 1 }
      }
      var ln: i64 = e - i
      if ln > 0 { if lbuf[i] != (CJX_HASH as u8) {
          if ln > CJX_PATHCAP-1 { ln = CJX_PATHCAP-1 }
          var k: i64 = 0
          while k < ln { path[k] = lbuf[i+k]; k = k + 1 }
          if ln > 0 { if path[ln-1] == (CJX_CR as u8) { ln = ln - 1 } }
          path[ln] = 0 as u8
          if ln > 0 {
              total = total + 1
              av[0] = elfp as i64
              av[1] = path as i64
              av[2] = path as i64
              av[3] = 0
              olen[0] = 0
              trunc[0] = 0
              let rc: i64 = tr_run_capture_tr(elfp, av, out, CJX_OUTCAP, olen, CJX_TIMEOUT_MS, trunc)
              if trunc[0] != 0 { truncated = truncated + 1 }
              var hv: i64 = 0-1
              if olen[0] > 0 { hv = cjx_field(out, olen[0], "\x22CHARJUDGE\x22:" as *u8) }
              if hv >= 0 {
                  judged = judged + 1
                  sum = sum + hv
                  if hv < mn { mn = hv }
                  if hv > mx { mx = hv }
                  sys_write(1, out, olen[0])
              }
              // A FAILURE IS NAMED, NEVER JUST COUNTED. rc and captured bytes are printed together
              // because they separate the causes that need opposite work: a missing judge binary forks
              // to exit 127 with zero bytes and reads exactly like a corrupt image if only one is shown.
              if hv < 0 {
                  failed = failed + 1
                  cjx_p("CJ-FAILED rc=" as *u8); cjx_n(rc)
                  cjx_p(" bytes=" as *u8); cjx_n(olen[0])
                  cjx_p(" path=" as *u8); cjx_p(path); cjx_p("\n" as *u8)
              }
          }
      } }
      i = e + 1
  }
  cjx_p("\n=== CHARJUDGE CENSUS ===\n" as *u8)
  cjx_p("corpus=" as *u8); cjx_n(total)
  cjx_p(" judged=" as *u8); cjx_n(judged)
  cjx_p(" failed=" as *u8); cjx_n(failed)
  cjx_p(" truncated=" as *u8); cjx_n(truncated)
  cjx_p("\n" as *u8)
  // A PARTITION IS A CLAIM: CHECK THE PARTS SUM, AND PRINT THE SUM. An unexplained residual is a leak,
  // and a census that cannot reconcile its own buckets must not have its numbers quoted.
  var recon: i64 = 0
  if judged + failed == total { recon = 1 }
  cjx_p("partition judged+failed=" as *u8); cjx_n(judged+failed)
  cjx_p(" corpus=" as *u8); cjx_n(total)
  if recon == 1 { cjx_p(" RECONCILES\n" as *u8) }
  if recon == 0 { cjx_p(" LEAKS -- these numbers are not publishable\n" as *u8) }
  if judged > 0 {
      cjx_p("headline min=" as *u8); cjx_n(mn)
      cjx_p(" max=" as *u8); cjx_n(mx)
      cjx_p(" mean=" as *u8); cjx_n(sum/judged)
      cjx_p("\n" as *u8)
  }
  // ZERO JUDGED IS UNMEASURED, NOT ZERO. A mean over an empty set is a fabricated number, and this is the
  // shape that lets a census whose subject never ran report a confident distribution of nothing.
  if judged == 0 { cjx_p("headline UNMEASURED -- zero images judged\n" as *u8) }
  if recon == 0 { return 1 }
  if truncated > 0 { return 1 }
  if judged == 0 { return 1 }
  return 0
1576}
nx_charjudge_census.nx source

`nx_charjudge_census.nx` source
